r300g: fix crash while binding a NULL constant buffer